Hum, it depends on lot of factors!
Obviously, most of the time, you don't make a choice, you take whatever the shop or project manager has chosen...
If you are independent, or doing a personal project, or manager yourself, you have to make a choice, of course.
An important factor is resource: basically the Web server where you will install the application (thus, somehow, the budget). If you have a low budget, you will probably take a shared host, with little power, and PHP is a probable choice. That's also what you get on some free hosts (like my own, Free.fr). Those offering .Net (or just good old ASP) are probably less common, and lot of low end hosts just discard Java as these applications tend to suck resources out of other projects sharing the server...
(I re-read and see you don't what to ear about cost, sorry, although I think it is still relevant.)
Note also there is no reason to limit yourself to the three "languages" you mention: you can very well write your project in Python, Perl, Lisp, even Lua, or nearly any language able to handle stdin and stdout...
Beside, another decision factor is the languages you know (or that your team masters!).
As for the language capabilities, I don't think security is a major choice factor, and even development processes/design are becoming close: .Net isn't unlike Java, and PHP5+ tries to catch up on the OO side.
So IMHO, it is more a question of resources, again, and mastery: you can write a very complex Web site in PHP (see deviantART.com for example) and make a crappy one in Java.